XispeScore API Versioning and Deprecation
The public REST API uses major-version URL paths such as /api/public/v1/.... Backward-compatible additions may be made inside the current major version. A change that would remove a documented field, change its meaning incompatibly, or otherwise break a conforming client requires a new major path instead of silently changing the existing contract.
No v1 endpoint is currently deprecated. Public REST responses link to this policy using the HTTP Link relation rel="deprecation". That policy link is a discovery mechanism; an endpoint is only considered deprecated when its response also carries the RFC 9745 Deprecation header with the effective deprecation date.
If a deprecated endpoint receives a planned retirement date, XispeScore will additionally send the RFC 8594 Sunset header. The Sunset date will not precede the deprecation date. Migration guidance and the replacement major-version endpoint, when available, will be published here and in the OpenAPI description before the old route is retired.
Public API responses also publish the current quota using RateLimit-Policy and RateLimit. Compatibility fields RateLimit-Limit, RateLimit-Remaining and RateLimit-Reset are included for clients and audits that still use earlier field names. A request rejected for quota exhaustion returns HTTP 429 and Retry-After.
The current default public quota is 120 requests per 60-second window per observed client address. It is intended to help agents self-throttle; upstream infrastructure may enforce additional protective limits. Clients should treat the response headers as authoritative for the request they just made rather than hard-coding the quota.